What does Cache-Control must-revalidate do?

must-revalidate is a `Cache-Control` response directive. Once the response is stale, a cache must not reuse it until it has revalidated it with the origin. If the cache cannot reach the origin, RFC 9111 says it must return an error rather than serve the stale copy, and that the status should be 504 Gateway Timeout.

Cache-Control: max-age=300, must-revalidate

While the response is fresh, must-revalidate changes nothing. It only removes a cache's freedom to serve stale content, which HTTP otherwise allows in some cases, such as when the cache is disconnected from the origin.

• It turns off `stale-while-revalidate` and `stale-if-error` in practice, because both serve stale responses without validation.
• proxy-revalidate is the same rule for shared caches only, and `s-maxage` implies it.
• RFC 9111 suggests using it only when serving stale content could cause incorrect operation. For most public pages, revalidation with an `ETag` and a stale window keeps pages available when the origin is down.